Revista Tinerilor Economiºti (The Young Economists Journal)

Management – Marketing - Tourism
or accepted by negligence. Worse, it is possible that a significant threat to be
intentionally disregarded
3. Analyzing The Internal And External Factors
Second, we must understand that the probability of an event depends on a series
of external factors as well as on internal factors of the entity (business/process/project)
for which the risk assessment is made. It is essential to know and control as many of
these factors as possible.
The internal factors include historical data from within the entity, collected in
time, as it is necessary to keep a record of all processed data, no matter if for the
moment it is thought that the data will not be useful in the future.
One way to achieve this without affecting the operational environment is
appealing to data warehousing technology and decision support systems. Without going
into technical details we mention only that the data warehouse is a way of storing data
and creating information, a topic-oriented database, integrated, nonvolatile, other
(sensitive) over time, which support management decisions. And decision support
system is in a simple definition, the layer of data presentation from the data warehouse.
In fact it is much more than a presentation layer: the decision support system extending
itself from extracting data from data warehouse to present these data to the decision
maker, including sophisticated reporting tools, tools, OLAP (Online Analytical
Processing) and Data Mining.
And when we talk about external factors, we are talking about those factors
undergoing STEEP analyses (Social, Technological, Economic, Environmental,
Political), factors that cannot be controlled but that could be anticipated. Here are also
included the events from the company’s activity, such as natural disasters or terrorist
attacks, attacks against informational systems (informational viruses, spam, DoS type
attacks etc.).
In order to evaluate these factors one may choose to study the statistical data
available from various sources including the FBI (eg CSI FBI Survey) or various
international information security experts centers such as CERT (Computer Emergency
Response Team), the Software Engineering Institute or CERIS (Centre of Expertise and
Response to Security Incidents).
But this data gives only a vague estimate of the probability of occurrence and
impact generated by such an occurrence. Such an approach is justified such as "always
be prepared for the worst."
4. Risk Analysis In The Software Development Cycle
Third, if we come closer to the electronic business environment and the fact
that one of the elements of this environment is the informational system, we must not
ignore the software risk, which represents the combination between the probabilities of
occurrence and the loss caused by an unwanted result which affects the project, the
process or the software product.
Each software system is unique with its own set of risks. There are many
software risks but fewer consequences that we want to avoid. Perhaps because of this
software risk is often discussed in terms of potential cost, timing and technical
consequences.
In software development business the risk management has a different
behavior; because in this case the accent falls more on the process of development and
77